Chinese Actors Exploit PHP2Shell to Compromise US Government Networks

• •Suspected Chinese actors compromised 25 PAN servers using PHP2Shell and a Linux kernel flaw.
• •The attack targeted US government-affiliated organizations, gaining root access within hours.
• •Palo Alto Networks confirmed the incident and urged immediate patching for affected customers.

A suspected Chinese nation-state actor exploited the PHP2Shell vulnerability alongside a Linux kernel flaw to gain root access to 25 Palo Alto Networks (PAN) firewall servers. The attack targeted organizations in the US, Japan, Taiwan, and South Korea, with a focus on US government-affiliated environments. The attackers utilized a custom exploit chain that allowed them to tunnel into internal networks and launch an Active Directory attack campaign. The exploits were executed from October 23 to 24, 2026, and were characterized by their automated and efficient nature. Palo Alto Networks confirmed that approximately 0.02% of its global installed base was affected, urging customers to apply patches for CVE-2026-109618 and CVE-2026-109619 immediately. The campaign demonstrates significant preparation and capability, indicating a sophisticated level of threat. The vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog due to.